Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-23918

Fixed in a distro release EPSS 50%CVSS 8.8

Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Published 2026-05-04 · CVE record · OSV

Products: Apache Software Foundation Apache HTTP Server, Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Core Services

Distro releases

ReleasePackageFixed in
Alpine:v3.20apache22.4.67-r0
Alpine:v3.21apache22.4.67-r0
Alpine:v3.22apache22.4.67-r0
Alpine:v3.23apache22.4.67-r0
Alpine:v3.24apache22.4.67-r0
Debian:12apache22.4.67-1~deb12u2
Debian:13apache22.4.66-1~deb13u2
Debian:14apache22.4.66-5
Red Hat:hummingbird:1httpd0:2.4.67-0.1.hum1
Red Hat:hummingbird:1httpd-core0:2.4.67-0.1.hum1
Red Hat:hummingbird:1httpd-devel0:2.4.67-0.1.hum1
Red Hat:hummingbird:1httpd-filesystem0:2.4.67-0.1.hum1
Red Hat:hummingbird:1httpd-manual0:2.4.67-0.1.hum1
Red Hat:hummingbird:1httpd-tools0:2.4.67-0.1.hum1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOSapache22.4.66-150400.6.57.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSSapache22.4.66-150400.6.57.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOSapache22.4.66-150400.6.57.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSSapache22.4.66-150400.6.57.1
SUSE:Linux Enterprise Server 12 SP5-LTSSapache22.4.66-35.78.1
SUSE:Linux Enterprise Server 12 SP5-LTSSapache2-tls132.4.66-35.78.1
SUSE:Linux Enterprise Server 15 SP4-LTSSapache22.4.66-150400.6.57.1
SUSE:Linux Enterprise Server 15 SP5-LTSSapache22.4.66-150400.6.57.1
SUSE:Linux Enterprise Server 16.0apache22.4.66-160000.2.1
SUSE:Linux Enterprise Server 16.0apache2-devel2.4.66-160000.2.1
SUSE:Linux Enterprise Server 16.0apache2-event2.4.66-160000.2.1
SUSE:Linux Enterprise Server 16.0apache2-manual2.4.66-160000.2.1
SUSE:Linux Enterprise Server 16.0apache2-prefork2.4.66-160000.2.1
SUSE:Linux Enterprise Server 16.0apache2-utils2.4.66-160000.2.1
SUSE:Linux Enterprise Server 16.0apache2-worker2.4.66-160000.2.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5apache22.4.66-35.78.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5apache2-tls132.4.66-35.78.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4apache22.4.66-150400.6.57.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5apache22.4.66-150400.6.57.1
SUSE:Linux Enterprise Server for SAP applications 16.0apache22.4.66-160000.2.1
SUSE:Linux Enterprise Server for SAP applications 16.0apache2-devel2.4.66-160000.2.1
SUSE:Linux Enterprise Server for SAP applications 16.0apache2-event2.4.66-160000.2.1
SUSE:Linux Enterprise Server for SAP applications 16.0apache2-manual2.4.66-160000.2.1
SUSE:Linux Enterprise Server for SAP applications 16.0apache2-prefork2.4.66-160000.2.1
SUSE:Linux Enterprise Server for SAP applications 16.0apache2-utils2.4.66-160000.2.1
SUSE:Linux Enterprise Server for SAP applications 16.0apache2-worker2.4.66-160000.2.1
Ubuntu:22.04:LTSapache22.4.52-1ubuntu4.20
Ubuntu:24.04:LTSapache22.4.58-1ubuntu8.12
Ubuntu:25.10apache22.4.64-1ubuntu3.4
Ubuntu:26.04:LTSapache22.4.66-2ubuntu2.1
openSUSE:Leap 16.0apache22.4.66-160000.2.1
openSUSE:Leap 16.0apache2-devel2.4.66-160000.2.1
openSUSE:Leap 16.0apache2-event2.4.66-160000.2.1
openSUSE:Leap 16.0apache2-manual2.4.66-160000.2.1
openSUSE:Leap 16.0apache2-prefork2.4.66-160000.2.1
openSUSE:Leap 16.0apache2-utils2.4.66-160000.2.1
openSUSE:Leap 16.0apache2-worker2.4.66-160000.2.1
openSUSE:Tumbleweedapache22.4.67-1.1